registry / Data exfiltration / @reboot-dev/reboot-std / 1.7.1

@reboot-dev/reboot-std@1.7.1

Reboot standard library.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

The package's install dependency chain activates default-on analytics that transmits installation metadata to scarf.sh without affirmative installer consent. This is an automatic installation disclosure, so I classify it as malicious data exfiltration under the installation beacon policy.

Static reason

No blocking static signals were detected.

Trigger

Installing the package with npm when analytics has not been explicitly disabled.

Impact

Installation metadata is disclosed to a third-party analytics service without an affirmative opt-in.

Mechanism

The Scarf postinstall reporter gathers platform, architecture, Node version, and dependency metadata, then posts it to scarf.sh.

Attack narrative

During installation, Scarf runs its postinstall reporter. The reporter defaults to opted in, builds an installation metadata payload, and sends it to scarf.sh unless the installer opts out; its notice does not require a yes before sending.

AI rationale

Evidence

package.json.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/package.json.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/report.js

Network endpoints1

scarf.sh

Decision evidence

public snapshot

AI called this Malicious at 88.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json declares Scarf as a runtime dependency, and Scarf's manifest runs its reporter during postinstall.
The reporter defaults to opted in; it proceeds unless the installer has opted out, without requiring an affirmative response.
The reporter builds an install payload containing platform, architecture, Node version, and dependency metadata.
The reporter selects scarf.sh and sends the payload in an HTTPS request.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 6.55 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-34json

2 "name": "@reboot-dev/reboot-std",

3 "version": "1.7.1",

4 "description": "Reboot standard library.",

5 "main": "index.js",

6 "type": "module",

7 "scripts": {

8 "test": "echo \"Error: no test specified\" && exit 1",

9 "build": "tsc"

10 },

11 "author": "reboot-dev",

12 "dependencies": {

13 "@reboot-dev/reboot-std-api": "1.7.1",

14 "@reboot-dev/reboot": "1.7.1",

15 "@scarf/scarf": "1.4.0"

16 },

17 "license": "Apache-2.0",

18 "devDependencies": {

19 "@types/node": "^26.6.4"

20 },

21 "exports": {

22 "./package.json": "./package.json",

High

Suspicious Lifecycle Evidence

package.json declares Scarf as a runtime dependency, and Scarf's manifest runs its reporter during postinstall.

package.jsonView on unpkg · L14

23 ".": "./index.js",

24 "./ciphertext/v1": "./ciphertext/v1/index.js",

25 "./collections/queue/v1": "./collections/queue/v1/index.js",

26 "./collections/ordered_map/v1": "./collections/ordered_map/v1/index.js",

27 "./collections/v1/sorted_map.js": "./collections/v1/sorted_map.js",

28 "./item/v1": "./item/v1/index.js",

29 "./presence/v1": "./presence/v1/index.js",

30 "./presence/subscriber/v1": "./presence/subscriber/v1/index.js",

31 "./presence/mouse_tracker/v1": "./presence/mouse_tracker/v1/index.js",

32 "./pubsub/v1": "./pubsub/v1/index.js",

33 "./index/v1": "./index/v1/index.js",

34 "./vitest": "./vitest/index.js"

.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/package.jsonView file

15"postinstall": "node ./report.js", "test": "jest --verbose" }, "author": "Scarf Systems", "license": "Apache-2.0", "devDependencies": { "jest": "^25.3.0", "mini

High

Suspicious Lifecycle Evidence

package.json declares Scarf as a runtime dependency, and Scarf's manifest runs its reporter during postinstall.

.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/package.jsonView on unpkg · L15

.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/report.jsView file

44return { defaultOptIn: true } } function logIfVerbose (toLog, stream) { if (process.env.SCARF_VERBOSE === 'true') { (stream || console.log)(toLog) } } // SCARF_NO_ANALYTICS was the original variable, we'll get rid of it eventually const userHa

High

Ai Review Evidence

The reporter defaults to opted in; it proceeds unless the installer has opted out, without requiring an affirmative response.

.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/report.jsView on unpkg · L44

281defaultOptIn) { if (userHasOptedOut(rootPackage)) { return reject(new Error('User has opted out')) } if (!userHasOptedIn(rootPackage)) { rateLimitedUserLog(optedInLogRateLimitKey, ` The dependency '${dependencyInfo.parent.name}' is tracking installation statistics using scarf-js (https://scarf.sh), which helps open-source developers fund and maintain their projects. Scarf securely logs basic installation details when this package is installed. The Scarf npm library is open source and permissively licensed at https://github.com/scarf-sh/sca

High

Ai Review Evidence

The reporter defaults to opted in; it proceeds unless the installer has opted out, without requiring an affirmative response.

.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/report.jsView on unpkg · L281

Source & flagged code

8 flagged · loading source

package.jsonView file

14"@reboot-dev/reboot": "1.7.1", "@scarf/scarf": "1.4.0" }, "license": "Apache-2.0", "devDependencies": { "@types/node": "^26.6.4" }, "exports": { "./package.js

High

Suspicious Lifecycle Evidence

package.json declares Scarf as a runtime dependency, and Scarf's manifest runs its reporter during postinstall.

package.jsonView on unpkg · L14

.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/package.jsonView file

15"postinstall": "node ./report.js", "test": "jest --verbose" }, "author": "Scarf Systems", "license": "Apache-2.0", "devDependencies": { "jest": "^25.3.0", "mini

High

Suspicious Lifecycle Evidence

package.json declares Scarf as a runtime dependency, and Scarf's manifest runs its reporter during postinstall.

.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/package.jsonView on unpkg · L15

Findings

8 High1 Low

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidence.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/package.json

HighAi Review Evidence.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/report.js

HighSuspicious Dependency Evidence.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/report.js

HighAi Review Evidence.lpm-dependency-evidence-33d84252-0d08-4fe4-b0cf-967eaacfefe9/2/npm-linux/report.js

Affected versions and remediation

This report applies to @reboot-dev/reboot-std@1.7.1.

See all versions of @reboot-dev/reboot-std for other recorded verdicts.

Avoid installing @reboot-dev/reboot-std@1.7.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-21 14:24:08.661Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other data exfiltration packages

Related packages

Other data exfiltration packages

Source & flagged code